Response to WannaCry Ransomware Attack – Update 1

As you may know, on May 12, hackers launched a global ransomware campaign against tens of thousands of corporate and governmental targets. The attack, known as WannaCry (also known as WannaCry, WCry, WanaCrypt, WanaCrypt0r, or Wanna Decrypt0r) is encrypting files and changing the extensions to: .wnry, .wcry, .wncry and .wncrypt, encrypts files on an infected computer and asks the computer's user to pay a ransom in order to regain access.

So far we have learned that this ransomware spreads via an email attachment or link. Once a user opens the attachment, WannaCry executes on that computer, encrypts files on local drives, and spreads across the network.

Affected Microsoft Products Include

Windows Server 2016

Windows Server 2012 and Windows Server 2012 R2

Windows Server 2008 R2

Windows Server 2008

Windows Server Core installation option

Windows 10

Windows RT 8.1

Windows 8.1

Windows 7

Windows Vista

The ransomware spreads itself over the network using a vulnerability in the SMB protocol, which is used by Microsoft for file sharing purposes. This flaw in Windows systems, now codenamed EternalBlue, was first leaked in the latest dump by a hacking group known as the Shadow Brokers. It's believed that the US National Security Agency (NSA) originally created EternalBlue, the tool that allowed WannaCry to quickly spread across large networks.

Microsoft released a patch MS17-010 to combat EternalBlue in March, yet the majority of targets that were hit on the 12th had neglected to update their systems.

The WannaCry malware attack spreads as a worm, which makes it even more devastating to its targets.